Privacy

What this site collects, and why.

Controller: Danilson Ramos (Bynilson), independent product engineer, Zürich, Switzerland — danilson.daveigaramos.pro@gmail.com. The principle: collect what is needed to answer your project, nothing more, and never sell or share it for advertising.

Updated 12 Oct 2026

01 — Data

What is collected

Project form: Name, email, company, website, profile, role in the decision, and your answers about the project (type, stage, complexity, timeline, budget, context, links). Used to reply and to assess whether and how the project can be delivered.
Attachments: Stored in private storage, never public, reachable only by the provider through ten-minute temporary links. Deleted 180 days after the conversation ends (project lost or delivered), or earlier on request.
Diagnostic order: Name, email, company, context. Payment is processed by Stripe: this site never sees or stores card data.
Where the visit came from: The first page visited, a source category (e.g. “google”, “linkedin”, never the full URL), UTM parameters and, where relevant, a partner code. Stored in your browser, then attached to your request if you send one — to know which channels bring projects.
Audience measurement: Vercel Web Analytics, cookieless, on aggregated data. A technical cookie `bx_exp` (no personal data) remembers the variant of a content test, for 180 days.
IP address: Used briefly in memory to limit form abuse; never stored with your request.

02 — Design Rescue

The Design Rescue service

The request: Your site’s address, your email and what you want redesigned; then, if you complete it, the brief (what bothers you, references, platform, budget, deadline, first name) and your screenshots. Used to analyse your site, quote and deliver the project.
The automated analysis: The public page you give is read once by a robot that identifies itself (“BynilsonDesignRescue”), with a few stylesheets. No copy of the page is kept: only the extracted findings (headings, text sizes, colours, structure) are stored. If a screenshot service is enabled, a capture of the page is stored in your private space.
The project space: Reached through a personal link sent by email (valid 30 days, renewable), no password. A technical cookie `bx_dr`, limited to the Design Rescue section, keeps access for 90 days on the device where you opened the link.
Payment: Processed by Stripe; this site never sees or stores card data. Kept: the amount, the date and the Stripe references of the payment.
Measurement: Funnel events (page viewed, analysis started, quote accepted…) are counted without your address, without your site’s URL and without any text you typed.

03 — Code Rescue

The Code Rescue service

The request: What isn’t working, what happens and what should happen, since when, the error message and the impact; the application’s public URL, its technologies, the AI tool used, the repository link, its stage and the urgency; your name, email and company; the time and version of your consent. Used to review the request, reply, quote and deliver the engagement.
Secrets: The form asks for no password, no key and no customer data. Anything that looks like a key, a token or a password is replaced by “[REDACTED]” before it is stored or emailed; only the number of values removed is kept.
Repository and URL: They are stored as text, without URL parameters. They are not opened, cloned or analysed automatically. Code access is arranged after qualification, with your agreement.
The project space: Reached through a personal link sent by email (valid 30 days, renewable), no password. A technical cookie `bx_cr`, limited to the Code Rescue section, keeps access for 90 days on the device where you opened the link.
Payment: Processed by Stripe; this site never sees or stores card data. Kept: the amount, the date and the Stripe references of the payment.
Measurement: Funnel events (page viewed, form started, step completed, quote accepted…) are counted with codes only (category, stage, package): never your address, your name, your application’s URL, your repository or any text you typed.

04 — Launch Rescue

The Launch Rescue service

The request: What your application does, its public URL, whether it is already deployed, its technologies and the AI tool used; its stage, your primary concern, the target launch date or milestone, whether there are paying users, the most critical workflow and the consequence of a failure; your name, email and company; the time and version of your consent. Optionally: the ShipCheck findings text you paste, and your self-assessment answers — codes only, attached only if you tick the box. Used to review the request, reply, quote and deliver the engagement.
Secrets: The form asks for no password, no key and no customer data. Anything that looks like a key, a token or a password is replaced by “[REDACTED]” before it is stored or emailed; only the number of values removed is kept.
The self-assessment: Your answers stay in your browser (local storage, key `bx_lr_checklist_v1`) until you attach them to a request; the “Reset” button erases them. Audience measurement only receives numbers (questions answered, “no”, “I don’t know”), never your answers.
The URL: It is stored as text, without URL parameters. It is not opened or analysed automatically. Access for the review is arranged after qualification, with your agreement.
The project space: Reached through a personal link sent by email (valid 30 days, renewable), no password. A technical cookie `bx_lr`, limited to the Launch Rescue section, keeps access for 90 days on the device where you opened the link.
Payment: Processed by Stripe; this site never sees or stores card data. Kept: the amount, the date and the Stripe references of the payment.
Measurement: Funnel events (page viewed, self-assessment started or completed, form started, quote accepted…) are counted with codes and numbers only (stage, concern, package): never your address, your name, your application’s URL, your answers or any text you typed.

05 — Conversion Rescue

The Conversion Rescue service

The free scan: You enter the public address of a page. URL parameters (after “?”) and the fragment (after “#”) are removed before any processing. Our server visits only that page, once, like a browser that identifies itself as Bynilson (with a link to this site). The page’s HTML is not kept. Kept: the signals read (headings, buttons, form fields, displayed prices…), the findings, the score and, when Google produced one, a screenshot of the first mobile screen.
Google PageSpeed Insights: To see the page in a real mobile browser, its address is sent to Google PageSpeed Insights (Google LLC), which loads and measures it. Only the page address is sent — never your email address or your IP address.
Your IP address: It is not stored. Only a cryptographic fingerprint (an HMAC with a secret key) is kept with the scan, to limit the number of scans per visitor; it is deleted with the scan.
The report link: The report is reachable only through a private, unguessable link, with no account. Anyone who has the link can read the report: only share it with people you choose.
Your email: It is only asked for if you save the report, and is used only to send you its link, plus at most one follow-up message if you ticked the box for it (unticked by default). The time and version of your consent are kept. For an audit or fixes request: your name, email, company, the conversion goal, a traffic band, the analytics tool, key pages and the findings you choose to hand over, to review the request, reply, quote and deliver the engagement.
Duration: Unsaved scans: 30 days, then deleted (screenshot included). Saved reports: 180 days, then deleted — unless the scan led to a request, which then follows the project retention below.
Project space and payment: As for the other services: a personal link sent by email, a technical cookie `bx_cv` limited to the Conversion Rescue section (90 days), and payment processed by Stripe without this site ever seeing card data.
Measurement: Funnel events (page viewed, scan started or completed, report saved, package chosen, quote accepted…) are counted with codes and numbers only (page type, number of findings, package): never your address, your email, the scanned URL or any text from the page.

06 — Guide

The guide « Créer avec l’IA ou déléguer ? » and its diagnostic

The free diagnostic: Your answers are coded choices kept in your browser (local storage, key `bx_boh_answers_v1`); they reach the server only if you use the page without JavaScript (they then travel in the page address) or copy your result link (coded choices in the address). Audience measurement receives only the recommended approach and the confidence level, never your answers.
The purchase: Processed by Stripe; this site never sees or stores card data. Kept: the receipt email address, the package, the amount, the date, the Stripe references and the payment status.
Access: A single-use sign-in link sent to the payment email (only its SHA-256 fingerprint is stored; valid 72 hours after purchase, 30 minutes on request), then a technical cookie `bx_guide`, limited to the guide section, for 90 days.
Your project sheet and cost model: Saved only when you click « Enregistrer »: short texts and choices, never documents. Anything that looks like a key or password is replaced with [REDACTED] before saving. Visible only to you, and to the provider if you ask for help.
Your feedback: Your answer to « Savez-vous quelle est votre prochaine étape ? » and, if you write it, what remains unclear (secrets masked). Anonymous on the diagnostic, linked to your access inside the guide. No email, no IP address.
The review request: Your name, email, project description, up to three links and, if you give it, your diagnostic code: to assess the request, reply and quote. No access to your code, accounts or data is requested.
Emails: The access email after purchase and the sign-in links you request. No promotional email.
Measurement: Journey events (purchase confirmed, guide opened, sheet saved, file downloaded, feedback sent…) are counted with codes only: never your email, your answers or your texts.

07 — Processors

Processors

Vercel: Site hosting and audience measurement.
Supabase: Database of requests and private storage of attachments and deliverables.
Resend: Email delivery (your copy, the notification to the provider).
Stripe: Payment of the diagnostic, Design Rescue, Code Rescue, Launch Rescue, Conversion Rescue, Build School products and the guide, invoices.
Google PageSpeed Insights (Google LLC): Receives only the public address of the page scanned by Conversion Rescue, to load it in a mobile browser and measure it.
Screenshot service (if enabled): Receives only the public address of the page to capture, for Design Rescue.
Page rendering service (if enabled): Receives only the public address of a JavaScript-built page, so that Conversion Rescue can read its displayed content.
Cloudflare Turnstile: Bot protection on the contact form.

Some of these processors handle data outside Switzerland, notably in the United States, on the basis of contractual safeguards (standard clauses).

08 — Retention

For how long

Attachments: 180 days after the conversation ends.
Conversion Rescue free scans: 30 days if not saved, 180 days if saved, screenshot included.
Design Rescue, Code Rescue, Launch Rescue and Conversion Rescue: captures, files, reports and deliverables 180 days after the project ends (completed, cancelled, declined or refunded); requests that did not go ahead 24 months after the last activity; paid projects: for the relationship, then the legal retention period for accounting records.
Requests that did not go ahead: 24 months after the last contact, then deleted.
Guide: purchase and access for the relationship, then the legal retention period for accounting records; project sheet, cost model and feedback until you ask for deletion (no automatic deletion yet).
Clients: for the relationship, then the legal retention period for accounting records (10 years for invoices).

09 — Your rights

Access, correction, deletion

You can ask at any time for access to your data, its correction or its deletion by writing to danilson.daveigaramos.pro@gmail.com. Reply within 30 days. You can also contact the Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, your supervisory authority.